Is my router compromised

I recently could not access my networked HP printer. I tried to access it via its network address and through the HP setup routine. Neither worked. Pinging did not work to get a response from either the printer or the router. Pinging 8.8.8.8 did work. I then tried to access the router via a browser. I guess its no security breach to post that I used the standard address 192.168.1.1 to get there. I cannot access the router. I tried my desktop and my laptop. I used Tumbleweed and Win7. Nothing worked, I even tried the Tor browser. Some time ago, I ran Tails from a usb stick on the laptop. After that, I often used the printer, so I doubt that Tails has anything to do with it.

Failing everything else, I downloaded the Linksys app to my iPad. Using it, I discovered that the router address has changed to 10.x.x.x and I didn’t do it. I tried rebooting the router but that didn’t work. There is a button on the bottom that I think resets it to factory specs. I haven’t done that yet as I don’t know how big of a headache that will lead to. I don’t know what the router password is. I thought it was the wifi password but it is not. I couldn’t guess the password. I could reset it from the Linksys app, but I want advice on whether that is enough.

As you can see, I still have internet access from all devices in my home, but no access to the printer.

By the way, I researched how to look at the network via cli. The commands ipconfig and ifconfig give me cnf. I don’t know the proper commands, so I looked this up. I did get a response to “if em1” Please tell me the proper commands to look at the network info since the ones I thought were proper were not.

The main question is: how did that router address change?

From your description, you’re talking about a Linksys device, probably some type of Gateway router(Not just any kind of router device).

If you don’t know what your router’s password is, then you have no idea how strong the password is and it also sounds like you have no way to inspect the router’s settings.

You should start by doing an Internet search for the default password for your Linksys (You’ll need the model as well to do your search).
When you have that password, save it somewhere that’s secure because although you won’t want to keep that password, it’s what the password will be when and whenever you do a factory reset. You can save this factory password anywhere and not be afraid it might be seen since this password is widely publicized.

Try to find a User Manual for your Linksys as well, it might have some useful info.
Do a little research for others who have done a factory reset with your Linksys model to know if others have had problems.

When you’re reasonably satisfied you know the procedure for doing a factory reset, go ahead and do it.

When your router reboots with its default settings, go ahead and do a preliminary test connection with a machine, no matter what OS is running you may be able to just restart the network service but again in all cases you can simply reboot the machine to acquire the new address from your router.

When any machine is working,
that machine should be able to connect to your router, but only from within your network.
Log into your router using the default password.
One of the first things you should do once your’e logged in is to change the password to something that can’t be guessed easily.
And then, you can modify its settings however you wish.

HTH,
TSU

When you can ping 8.8.8.8, you have access to the internet, which basicaly means that you have your NIC configured (IP address, netmask), that you have a routing table that points to your router for outside connections.

When you want to see how your NIC is configured:

ip address

When you want to see your routing table:

ip route

which will then also show you the IP address of your default router.

This all of course tells nothing about other devices in your network (e.g. your HP printer), but they should have an IP adress with the same network address as your system and the router and the same netmask.

It also does not say much on an eventual other network address (and thus IP address(es)) in the past.

In any case, as well as 192.168.1.0/24 as 10.0.0.0/8 are private address ranges and does can be used for LAN purposes.

I can of course say nothing about connecting to your router using an HTTP interface and what username/password to use, as you did not even tell what the maker/type is. And of course you should have the documentation. In any case, it is very unlikely that the management password of the router is by chance the same as the WiFi password of the SSD it offers.

Hi
If an ISP provided gateway router (cable, DSL, fibre?), could have done a firmware update and it was reset remotely…

I would look for the manual online and do a factory reset and restore from your latest backup(?), yes you can/should backup your router config for this very scenario :wink:

BTW, when the router’s IP address range of the LAN was indeed changed (e.g. by the provider as Malcomlm suggests), the switching off/on the HP printer might give it a new IP address in the new range (when it uses DHCP). Nevertheless, you then have to reconfigure CUPS to that new address.

Thanks to all for the suggestions.

I looked up the factory password for my router on Google. Then I used the reset button on the bottom of the router. It did not take the first time! But, I did it again and it reset to factory specs including the common password. Once I was able to access the router, I changed the password. All my devices are now accessible.

The firmware is up to date. It is set to automatically update, so it may well have been a remote reset of the router’s address that gave me this headache. Why that would happen, or be allowed is a mystery to me.

I first tried unplugging the router to see if it would reset. I wish I followed the suggestion to do that to the printer before I drove myself crazy trying to figure out what went wrong!

Thanks again to all.

Hi
I would set to not auto update and manually perform if you can… don’t forget to backup and save somewhere :wink:

On Fri, 30 Nov 2018 15:36:03 +0000, Prexy wrote:

> Nothing worked, I even tried the Tor browser.

FWIW, that should never work to a local device, because Tor browser
routes over the internet and doesn’t “know” about local devices. Its
entire purpose is to mask your public IP address, and to do that, it
routes all communications over a tunnel it establishes with a system
outside your local network.

Jim


Jim Henderson
openSUSE Forums Administrator
Forum Use Terms & Conditions at http://tinyurl.com/openSUSE-T-C

Never compromise with your router. For the best internet connection, you should have properly configured router. Still, if you are facing any issue, you can consult with expert technicians. You can visit here: https://routerloginnet.live/netgear-wifi-router-login/